A new phishing attack has been discovered, which uses malicious archive files to exploit the recently found WinRAR vulnerability CVE-2023-38831 using a Powershell script that steals credentials from Google Chrome and Microsoft Edge browsers.

The archive consists of a PDF document that shows the list of Indicators of Compromise (IOCs), which includes domain names and hashes associated with different malware like SmokeLoader, Nanocore RAT, Crimson RAT, and AgentTesla.

Due to the WinRAR vulnerability, threat actors could create a reverse shell on the affected system and execute PowerShell scripts.

Technical Analysis – CVE-2023-38831

CVE-2023-38831 was an arbitrary code execution vulnerability in WinRAR 6.23, which can be exploited by including an ordinary file (a JPG file) and also a folder with the same name as the file embedding inside the ZIP archive.

If the folder consists of executable content, it is processed when WinRAR attempts to access only the ordinary file.

This vulnerability in WinRAR was reportedly executed in the wild between April and August 2023.

However, WinRAR has released patches for fixing this vulnerability. This vulnerability was exploited in the current phishing campaign.

Exploiting the CVE-2023-38831

Threat actors used a file named IOC_09_11.rar to pretend to be a file that might contain Indicators of Compromise. This RAR file consists of a folder and a file named “IOC_09_11.pdf”. The folder consists of the “IOC_09_11.pdf[.]cmd, ” a BAT script.

Due to the vulnerability, when opening the PDF file, the BAT script is executed from the folder, which extracts the RAR file contents in the %TEMP% directory. Once extracted, the script file gets deleted from the folder and opens the PDF file for the victim to view.

Three Malicious Powershell commands

When the victim starts to view the contents of the PDF, the script starts to proceed with its intended work by launching three PowerShell commands. The first command creates a Private RSA Key in the %LOCALAPPDATA%\Temp folder, the second opens a reverse shell to the victim machine, and the third executes a Base64-encoded string.

In addition, the script steals the Login credentials from Google Chrome and Microsoft Edge browsers, which are then sent to the threat actor using the legit Webhook.Site service using a unique URL.

Furthermore, a complete report has been published by Cluster25, which provides detailed information about the source code, PowerShell commands, and other information. 

Indicators of Compromise

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.